ChatGPT and chartered accountants: what you can share without breaching professional secrecy

What can ChatGPT do for an accounting firm?

The Ordre's booklet on generative AI devotes a whole section to prompts for firms. So the question isn't whether to use it, but with which data.

With no client data at all

Part of the work requires nothing about a client: explaining to a business owner the difference between output VAT and input VAT, summarizing an article from the BOFiP (the French tax authority's official guidance), preparing a year-end closing checklist or a standard reminder letter. The booklet offers a prompt for each of these cases. Secrecy isn't at stake; the answers still need checking, because the AI can state false things.

On a pseudonymized copy

As soon as the work concerns a specific file, the AI needs the document: an annual summary note for the business owner, a letter to adapt, an engagement letter to complete, a draft shareholders' meeting minutes to proofread, articles of association to summarize. These documents are texts: each name can be replaced with a stable label, the company name with [ORGANISATION_1], the manager with [PERSONNE_1], without the AI losing track of who does what.

What must not go out in clear

Raw, nominative files stay out of the AI until they have been anonymized. In practice, don't paste in clear:

• raw data: FEC, general ledger, trial balance, exports from the production software;
• payroll: DSN, payslips, salary statements;
• correspondence: client emails, with their signature and history;
• supporting documents: ID documents, bank details, scanned invoices.

FECs, DSNs and client emails are named explicitly in the precautions of the Ordre's national council, detailed below.

Can a chartered accountant use ChatGPT without breaching professional secrecy?

Professional secrecy

Article 21 of ordinance no. 45-2138 of September 19, 1945 binds chartered accountants, trainee chartered accountants and other persons it lists to professional secrecy, “under the penalties set by article 226-13 of the Criminal Code” (our translation). Article 226-13 of the French Criminal Code (Code pénal) punishes with one year's imprisonment and a €15,000 fine the disclosure of secret information by a person who holds it, in particular through their profession.

Yet an online AI is a service run by a third party: a document pasted into the conversation leaves the firm. The Ordre's booklet itself lists confidentiality among the risks of generative AI: what you enter can be reused without the user knowing.

GDPR and data minimization

As soon as they are natural persons, your clients' managers, partners and employees are protected by the GDPR: their names, addresses or salaries are personal data. Article 5 of the GDPR requires data to be “adequate, relevant and limited to what is necessary” for the purpose. To rephrase a letter, the AI doesn't need the employee's real name.

The GDPR doesn't cover data about companies, “including the name and the form of the legal person and the contact details of the legal person” (recital 14); still, mask the company name, since it is your client's identity. Another point: for the firm, which keeps the mapping table, a pseudonymized copy remains subject to the GDPR. Data that can be linked to a person using additional information is indeed considered to relate to an identifiable person (recital 26). See the difference between anonymization and pseudonymization under the GDPR.

Payroll data

Payroll concerns people who aren't your clients: their employees. Salaries, social security numbers, contact details: none of this is needed to draft a letter or explain a rule. For a payroll question, describe a typical situation, for example a part-time employee hired mid-month, rather than pasting a payslip.

What does the Ordre des experts-comptables recommend on AI?

The booklet “IA et IA générative adaptées à la profession du chiffre” (August 2025). The first of its five good practices concerns data protection. It asks accountants not to put any confidential or sensitive information into the AI and ends with this sentence: “Pseudonymize or anonymize the data given to the AI” (our translation). The second invites them to choose GDPR-compliant solutions with data hosted in the European Union. The third asks them to check the answers systematically.

The national council's notice “Comment utiliser ChatGPT ?” (2024). Its precautions for use explicitly name client emails, FECs and DSNs that haven't been anonymized, which must not be uploaded to online services the firm doesn't control, in the name of the GDPR and professional secrecy. It recalls that the AI's answers may be wrong, even made up, and lists the analysis of anonymous data among the possible uses once these precautions are taken.

The instruction doesn't change from one document to the next: what goes to the AI is pseudonymized or anonymized, and what it sends back is checked.

ExpertCHAT: what is the Ordre's chatbot for?

ExpertCHAT is the chatbot of the Ordre des experts-comptables. According to the national council's notice “Comment utiliser ChatGPT ?” (pp. 17-18), it is reserved for chartered accountants, available through Comptexpert, and answers only from the resources of the Ordre's private website: engagement letters, standards, guides. It covers regulatory matters, practicing the profession and engagements; for tax, payroll or legal questions, the notice points to other tools.

ExpertCHAT and ChatGPT therefore do not do the same job. ExpertCHAT answers a professional question from the Ordre's texts; ChatGPT drafts, summarizes or rephrases from what you give it. For a letter or a note on a client file, that is the second task, and the rule stays the same: a pseudonymized copy, prepared on the firm's computer with document anonymization software for chartered accountants.

Which AI for a chartered accountant?

The booklet compares six assistants: ChatGPT, Claude, Perplexity, Mistral, Copilot 365 and Gemini, with data as of July 1, 2025. On the client data line, it answers no for ChatGPT, Claude, Perplexity and Mistral. It allows client data in Copilot 365 only if the GDPR option is enabled in its admin settings, and in Gemini only in a secure Google environment with explicit consent. The booklet warns that this table may have aged.

To choose, keep its criteria: a professional solution, assessed and suited to the profession, GDPR-compliant, with data hosted in the European Union. None of these criteria removes the need to prepare the copy: even when well configured, the tool receives whatever you paste into it.

What should you mask in a client file before ChatGPT?

Before sending a document, identify everything that identifies the client, its managers and its employees. The table also shows what AnonymFiles detects automatically and what is masked by hand.

No automatic detection is perfect, and a copy without names can still point to someone by cross-referencing. Also check the file itself: a PDF's properties can contain its author's name, hence the value of knowing how to remove a PDF's metadata.

How do you prepare the copy with AnonymFiles?

AnonymFiles is a desktop app, coming soon for Apple silicon Macs and Windows, that prepares these copies on the firm's computer. You drop in a client's file: text or scanned PDFs (local OCR), Word, .eml and .msg emails, Excel and CSV, PowerPoint, .txt or .md files. The app replaces what it detects with stable labels such as [ORGANISATION_1] or [PERSONNE_1]; the same person keeps the same label in every document of the file.

You then review each document, original and copy side by side, and mask in one click whatever is missing, amounts in particular. Nothing is exported without your approval. On export, masked content is truly removed; metadata, annotations, forms and links are removed; file names become neutral and an index lists the exported and excluded documents. The mapping table stays on your computer, never in the export.

After export, the app gives you an instruction to paste into the AI so it keeps the labels intact. You then put the real names back into its answer, as text, Word or PDF, on your computer.

The app works with no account, no telemetry and no online license check. On Mac, the detection models are included: no connection at all. On Windows, they are downloaded once, on first use, without any document text. The security page details the app's network perimeter. Pricing: €290 excl. VAT per seat per year (Pro, 1 or 2 seats), €240 excl. VAT per seat per year from 3 seats (Firm), on quote above 20 seats. See our document anonymization software for chartered accountants.

What AnonymFiles doesn't do

AnonymFiles reads Excel and CSV files, one table per sheet with the cell values, and scans by local OCR; it isn't designed for FECs or DSNs, which are reviewed line by line. To understand what's at stake in a scan, see why a scanned PDF needs separate handling. Finally, the copy of a Word file is a redacted .docx that keeps its layout: body, headers, footers and notes are processed; comments, tracked changes and images are removed, and a text file accompanies the copy for the AI.

ChatGPT prompts for chartered accountants: four examples

These prompts assume a copy that has already been prepared and reviewed, with the AnonymFiles instruction pasted at the start of the conversation. They follow, in short form, the pattern of the booklet's examples: a role, a task, constraints, a format. For the general method, see how to anonymize a document before sending it to ChatGPT.

Summary note for the business owner

Explanatory letter to a client

Engagement letter to complete

Proofreading shareholders' meeting minutes

Review each answer as you would a colleague's work, then put the real names back on your computer.